matlab-discover-clusters
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a binary MATLAB P-code file (scripts/discoverClusters.p) to perform cluster discovery. While P-code is a standard MATLAB format for protecting intellectual property, its binary nature prevents full static analysis of the logic.
- [PROMPT_INJECTION]: The skill processes potentially untrusted metadata from network-discovered clusters, creating a surface for indirect prompt injection attacks. 1. Ingestion points: The discoverClusters function retrieves cluster names, hostnames, and properties from the local network and filesystem. 2. Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when processing discovered cluster data. 3. Capability inventory: The agent can create, modify, validate, and delete cluster profiles based on this discovered data. 4. Sanitization: The skill lacks explicit sanitization or validation of the strings returned by the discovery process before they are displayed or used in subsequent commands.
Audit Metadata